> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airmdr.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Tenable
> The connection allows to connect Tenable.io to AirMDR to retrieve vulnerability findings, asset information, scan results, and reports for security investigations. The integration helps analysts enrich alerts, assess affected assets, and prioritize remediation using information available in Tenable.
This guide explains how to generate an **Access Key** and **Secret Key** in [Tenable.io](http://Tenable.io), identify the **Base URL**, and configure the connection in AirMDR.
The integration supports the following workflows through its available skills:
* Retrieve vulnerability findings to enrich security investigations.
* Identify assets associated with an IP address, hostname, or vulnerability.
* Export asset and vulnerability records for data collection.
* Review scan results and generate reports.
* Retrieve attack paths where the required Exposure Management capabilities are available.
Creating a connection stores the credentials used by AirMDR skills. Configure the relevant skills or playbooks to retrieve data or perform scheduled collection.
| Item | Details |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| **Product** | Tenable.io, now named Tenable Vulnerability Management. Current documentation also uses Tenable One Vulnerability Management. |
| **Deployment** | Tenable-hosted cloud service. |
| **API compatibility** | Uses the Tenable cloud APIs associated with the configured skills. There is no customer-installed server version to select. |
| **Base URL** | `https://cloud.tenable.com` for the standard commercial service. |
| **Authentication** | Access Key and Secret Key supplied through the `X-ApiKeys` request header. |
| **Additional capabilities** | Some skills use Exposure Management APIs. Confirm that your tenant has the necessary subscription entitlements and permissions. |
The supplied skills use both Vulnerability Management and Exposure Management API resources. In particular, finding searches and attack-path searches use Exposure Management endpoints.
For specialized Tenable cloud environments, confirm the API hostname and AirMDR compatibility before configuration.
AirMDR authenticates to Tenable.io using an **Access Key** and **Secret Key** generated for a Tenable user account.
Tenable.io API requests use the following header: `X-ApiKeys: accessKey=; secretKey=;`
Enter the key values separately in AirMDR. Do not include `accessKey=`, `secretKey=`, or the complete header in the credential fields.
This connection uses API keys; it does not require an OAuth client ID, client secret, or interactive login session for each request. [Tenable API authorization](https://developer.tenable.com/docs/authorization?utm_source=chatgpt.com).
**Role and Access Considerations**
* Use a dedicated integration account to separate AirMDR access from personal user activity.
* Enable API-key authentication for that account.
* Assign the role and resource permissions required by the selected skills.
* Ensure that the account can access the relevant assets and scans.
* Have an administrator generate credentials for an API-only account.
Permission to generate API keys does not establish access to every Tenable resource.
**Examples of Endpoint Permissions**
The following are verified requirements for individual API operations. They are **not a complete permissions matrix for all integration skills**.
| API Operation | Documented Role or Custom Privilege |
| :---------------------- | :---------------------------------------------------------------------------------------------------------------------------------- |
| **List scans** | **Basic \[16]** role with **Can View \[16]** scan permission, or the documented custom-role alternative: `VM.VM_SCAN.VM_SCAN.READ`. |
| **Search findings** | **Basic \[16]** role, or both `ASSET_INVENTORY.CYBER_ASSET_MANAGEMENT.READ` and `AD.TOGGLE_AD.USE`. |
| **Search attack paths** | **Basic \[16]** role, or `ATTACK_PATH_ANALYSIS.QUERY.SEARCH`. |
An AirMDR skill may call multiple endpoints. Validate permissions for the complete operation, including any export-status and download requests.
## Pre-requisites
>
> An active [Tenable.io](http://Tenable.io) subscription with access to the APIs required by your selected skills.
>
>
>
> A dedicated Tenable integration account with API-key authentication enabled and appropriate permissions to access the required assets, vulnerabilities, scans, and reports.
>
>
>
> A Tenable administrator available to configure user access when necessary.
>
## Setup Steps
To connect Tenable.io to AirMDR, first verify API access for the integration account, generate its credentials, and identify the Base URL. Then enter these values in AirMDR and validate a skill execution.
Updating another user’s access requires a Tenable administrator.
1. Sign in to [Tenable cloud](https://cloud.tenable.com/).
2. Open **Settings → Access Control → Users**.
3. Select the dedicated integration user.
4. In the authentication settings, enable **API Key**.
5. Review the user’s role and resource permissions.
6. Click **Save**.
If a dedicated account does not exist, have the administrator create one and assign access for the required integration operations.
Use the procedure appropriate to the integration account’s login access.
#### Option A: Generate Keys for Your Own Account
Use this procedure when the integration account has interactive login access.
1. Sign in to [Tenable.io](http://Tenable.io) using the integration account.
2. Click the **blue user circle** in the upper-right corner.
3. Select **My Profile**.
The **My Account** page opens.
4. Select the **API Keys** tab.
5. Click **Generate**.
6. Review the replacement warning and click **Generate** to confirm.
7. Copy the **Access Key** and **Secret Key** to approved credential storage before leaving the page.
Generating a new pair replaces the account’s existing keys. Coordinate the change with any applications using those credentials.
If **Generate** is unavailable, ask the administrator to verify API access for the account.
#### Option B: Have an Administrator Generate the Keys
Use this procedure for an API-only account or when an administrator manages the integration credentials.
1. Open **Settings → Access Control → Users**.
2. Select the integration user.
3. In **API Keys**, click **Generate API Keys**.
4. Review the warning and select **Replace & Generate**.
5. Copy both keys to approved credential storage before navigating away.
For the standard commercial [Tenable.io](http://Tenable.io) service, enter: [https://cloud.tenable.com](https://cloud.tenable.com).
The Base URL identifies the service. Individual skills add the required API resource path.
| URL Type | Example |
| :------------------------ | :-------------------------------- |
| **Base URL** | `https://cloud.tenable.com` |
| **Complete API endpoint** | `https://cloud.tenable.com/scans` |
Do not include a browser navigation fragment, query string, or endpoint path such as `/scans` in the **Base URL** field. The official authorization example uses this cloud hostname.
## Tenable Credential Reference Table
| AirMDR Field | What to Enter | Where to Get It in the UI | Example |
| -------------- | ----------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | --------------------------- |
| **Access Key** | The access key generated for the dedicated Tenable integration account. | User circle → **My Profile → API Keys → Generate**. An administrator can also generate keys from the integration user’s account record. | `` |
| **Secret Key** | The secret key generated together with the access key. | Copy it from the same key-generation screen before leaving the page. | `` |
| **Base URL** | The Tenable.io API service origin. | For the standard commercial service, use the documented address below. This value is not generated in the API Keys tab. | `https://cloud.tenable.com` |
Enter the Base URL explicitly, even though the supplied AirMDR form does not mark it as mandatory. The connector’s default value has not been confirmed.
## Validate Connectivity
The following optional read-only API requests validate Tenable access separately from the AirMDR connector.
Run them from an authorized environment with the same network reachability as the integration.
The token or service account role must permit `GET /api/v2/events/datasearch/alert`. Permission for a Dataexport endpoint does not automatically establish permission for this endpoint.
In Bash, use the following prompts to avoid placing the literal key values in command history:
```text theme={null}
read -r -s -p "Tenable access key: " TENABLE_ACCESS_KEY
printf '\n'
read -r -s -p "Tenable secret key: " TENABLE_SECRET_KEY
printf '\n'
```
```text theme={null}
curl --silent --show-error --include \
--request GET 'https://cloud.tenable.com/scans' \
--header "X-ApiKeys: accessKey=${TENABLE_ACCESS_KEY}; secretKey=${TENABLE_SECRET_KEY};" \
--header 'Accept: application/json'
```
* HTTP status `200`.
* A JSON response containing the accessible scan information.
This endpoint requires the **Basic \[16]** role and **Can View \[16]** scan permission, or the documented custom-role alternative.
These permissions apply to this diagnostic endpoint, not every AirMDR skill. An empty scan list does not prove access to the resources required by the integration.
## Configure Tenable in AirMDR Integrations Dashboard
1. Navigate to [AirMDR](https://app.airmdr.com/auth/login), provide the credentials and click **Login**
2. Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select **ADMIN → Integrations**.
3. Use the search option, enter the keyword "**Tenable**", select the **Connections** tab, and click **+ New Connection** button.
4. Use the following values in the AirMDR integration configuration screen:
| Field | What to Enter | Example |
| ---------------- | ------------------------------------------------- | ----------------------------------------------- |
| **Instance** | A descriptive name for the connection. | `Tenable-IO-Production` |
| **Organization** | The AirMDR organization that owns the connection. | Select the appropriate organization. |
| **Description** | A brief description of the connection’s purpose. | `Tenable.io vulnerability and asset enrichment` |
| **Access Key** | The generated access key. | `` |
| **Secret Key** | The corresponding secret key. | `` |
| **Base URL** | The Tenable.io service origin. | `https://cloud.tenable.com` |
1. In **Remote Agent**, select an AirMDR Remote Agent when your Tenable deployment requires a private network connection, an approved proxy, or a controlled outbound network route.
* **[Tenable.io](http://Tenable.io):** If API IP allowlisting is enabled, ensure that the selected execution environment’s outbound IP address is permitted.
Otherwise, leave this field unselected unless instructed by your AirMDR administrator.
2. In **Expiry**, select a date according to your organization’s credential-rotation policy. Coordinate this date with the planned replacement of the Tenable **Access Key** and **Secret Key**.
Manage API-key replacement in Tenable separately from the AirMDR **Expiry** setting. Generating a new pair replaces the previous pair. Update both values in AirMDR promptly and validate the connection.
5. Click **Save**.
## Skills provided by this Integration
The Tenable integration provides skills for retrieving asset information, investigating vulnerabilities, analyzing attack paths, and generating reports. The following skills are grouped by their purpose.
Use these skills to identify assets involved in an investigation and retrieve asset inventory data.
| Skill | Purpose | Permissions Required |
| ------------------------- | ----------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Get Tenable assets** | Search assets by hostname, FQDN, or IP address, or retrieve detailed information using an asset UUID. | **Basic** role and access to the requested assets. The inventory-search operation also requires access to the relevant Exposure Management capability. |
| **Export Tenable assets** | Export asset records in bulk for inventory synchronization and scheduled collection. | **Basic** role with **Can View** permission for the assets being exported. |
Use these skills to investigate security findings, understand affected assets, and retrieve remediation information.
| Skill | Purpose | Permissions Required |
| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Get Tenable findings** | Search findings by CVE, asset ID, or finding ID to enrich security investigations. | **Basic** role and access to the relevant Exposure Management findings. |
| **Get Tenable asset vulnerabilities** | List vulnerabilities on an asset and optionally retrieve detection details, remediation guidance, and supporting plugin output. | **Basic** role for listing vulnerabilities, with access to the requested asset’s vulnerability data. Confirm permissions for the optional detail and plugin-output requests. |
| **Get Tenable vulnerability details** | Retrieve vulnerability descriptions, remediation guidance, affected asset information, and optional plugin metadata. | **Basic** role for the workbench details request. Confirm access for the additional plugin-catalogue request when enabled. |
| **Export Tenable vulnerabilities** | Export vulnerability records in bulk for ingestion or historical collection. | **Basic** role with **Can View** permission for the assets whose vulnerabilities are exported. |
Use this skill to assess how weaknesses could allow an attacker to reach critical assets.
| Skill | Purpose | Permissions Required |
| ---------------------------- | ------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- |
| **Get Tenable attack paths** | Retrieve attack paths, affected assets, priority scores, associated techniques, and remediation status. | **Basic** role and access to the Exposure Management attack-path capability. |
Use these skills to review scan coverage and retrieve reports for investigations or security reviews.
| Skill | Purpose | Permissions Required |
| ------------------------------ | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Get Tenable scans** | List scans or retrieve detailed results for a specific scan or historical run. | **Basic** role to list scans. **Scan Operator** role to retrieve a specific scan’s results. Both operations require **Can View** permission for the relevant scans. |
| **Generate Tenable report** | Generate a PDF report summarizing vulnerabilities, plugins, or affected assets. | **Basic** role for report creation and status retrieval. Validate access through the complete workflow, including downloading the generated report. |
| **Export Tenable scan report** | Export the results of a specific scan or historical run in a supported format. | **Scan Operator** role with **Can View** permission for the scan. These requirements cover export creation, status polling, and download. |
**Generate Tenable report** produces a template-based report across the selected vulnerability data. **Export Tenable scan report** exports the results of an individual scan run.
Use this skill to identify valid filters before configuring searches, exports, or reports.
| Skill | Purpose | Permissions Required |
| --------------------------------- | -------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Get Tenable filter properties** | Retrieve supported properties, operators, data types, and allowed values for constructing valid filters. | **Basic** role for finding-property discovery. Permissions for other resource types depend on the endpoint selected by the skill and require separate validation. |
To view the details of Input Parameters and Output for the respective skills
* Go to [AirMDR → Tenable](https://app.airmdr.com/integrationsv2/a79eb00e-348c-484d-9728-854feff7a492/skills?search=tenable) Integration page.
* Select the **Skills** tab and click on the required listed skills.
## Additional Information
**✅ Do**
* Use a dedicated integration account and grant only the required permissions.
* Store the **Access Key** and **Secret Key** in approved credential storage.
* Validate HTTPS certificates and confirm endpoint ownership.
* Restrict API access to approved integration outbound IP addresses where applicable.
* Coordinate key rotation, update AirMDR, and validate the connection afterward.
* Revoke unused credentials when decommissioning the integration.
**❌ Don’t**
* Share a personal administrator account across integrations.
* Paste credentials into tickets, messages, documentation, or screenshots.
* Disable TLS verification to bypass connection errors.
* Add broad IP ranges without reviewing the access impact.
* Regenerate keys without checking other applications using the same account.
* Leave unused integration accounts active indefinitely.
* 📧 Contact [**AirMDR Support**](mailto:support@airmdr.com) through your designated support channel.
* 📧 Contact [Tenable Support](https://connect.tenable.com/category/support?utm_source=chatgpt.com) for Tenable account, API, or platform issues.
* 🔁 Rotate credentials regularly. Recommended cadence: As per internal security policy
* 🔄 **Reconnect in AirMDR immediately when API Keys are changed.**
AirMDR sends authenticated requests to Tenable.io. Tenable returns information permitted by the account’s permissions and available product capabilities. AirMDR skills use that information for enrichment, investigation, exports, and reporting.
**Data Exchanged**
| Data Type | Examples |
| :---------------------------- | :--------------------------------------------------------------------------------------------- |
| **Asset information** | Asset identifiers, IP addresses, hostnames, operating systems, tags, and exposure information. |
| **Vulnerability information** | Findings, CVEs, severity, plugin details, remediation guidance, and detection evidence. |
| **Scan information** | Scan status, targets, execution information, and results. |
| **Reports** | Generated vulnerability reports and exported scan results. |
| **Attack paths** | Associated assets, techniques, priorities, and remediation status, where available. |
**Network and Security Requirements**
| Item | Requirement |
| :------------------------------ | :--------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Destination** | `cloud.tenable.com` for the standard commercial service. |
| **Protocol** | HTTPS. |
| **Port** | TCP 443. |
| **Authentication** | `X-ApiKeys` header containing the access and secret keys. |
| **Certificate validation** | Keep certificate and hostname verification enabled. |
| **IP restrictions** | Permit the approved outbound IP addresses used by the integration, where API allowlisting is configured. |
| **Stored data and credentials** | Apply approved AirMDR credential-storage and retention policies. Obtain specific encryption-at-rest details from the applicable platform security documentation. |
**Review API IP Restrictions**
If your tenant restricts API access by IP address:
1. Open **Settings → Access Control**.
2. Select **API Access Security**.
3. Review the configured allowed addresses.
4. Ensure that the integration’s approved outbound addresses are included.
5. Account for IPv4 and IPv6 where applicable.
| Symptom | Likely Cause | Recovery Action |
| :------------------------------------ | :------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------- |
| **Generate** is unavailable | API access is disabled for the account. | Ask an administrator to enable API-key access. |
| HTTP `401` | Invalid, mismatched, or replaced credentials. | Verify both key values and update AirMDR if they were rotated. |
| HTTP `403` or access denied | Missing permissions, resource restrictions, or unavailable product capabilities. | Review the endpoint requirements, account access, and tenant entitlements. |
| HTTP `400` | Invalid filters, unsupported properties, or missing inputs. | Check the skill inputs and use **Get Tenable filter properties** where applicable. |
| HTTP `404` or an HTML response | Incorrect Base URL or request path. | Verify `https://cloud.tenable.com` and ensure that the Base URL has no UI route or endpoint suffix. |
| HTTP `429` | API rate limit exceeded. | Honor `Retry-After` and reduce request frequency or concurrent activity. |
| HTTP `5xx` | Service or upstream processing error. | Retry with a delay. Escalate persistent failures with sanitized diagnostics. |
| DNS error or timeout | Network, proxy, firewall, or hostname issue. | Test connectivity from the actual execution environment. |
| TLS validation failure | Untrusted issuer, certificate mismatch, or interception issue. | Correct the trust configuration. Keep certificate verification enabled. |
| Successful request with empty results | Filters exclude the data, access is restricted, or no matching records exist. | Test against a known resource and review the query scope. |
| Export or report remains pending | The requested job is still processing. | Follow the skill’s status-polling or resume procedure using the returned job identifier. |
| Export results are truncated | The configured result limit was reached. | Review `max_records` and the returned truncation indicator; retrieve the required data in appropriately bounded operations. |
Tenable documents `401`, `429`, and `500` responses for the scan-list endpoint. For throttling, the cloud API returns a `Retry-After`value indicating how long to wait.
**Where to Review Activity**
| Location | What to Review |
| :------------------------------------------------------------ | :------------------------------------------------------------------------- |
| **AirMDR skill or playbook execution details** | Connection used, execution status, returned data, and errors. |
| **[Tenable.io](http://Tenable.io): Settings → Activity Logs** | Relevant user and configuration activity. |
| **Approved network or proxy logs** | Connection failures, blocked requests, and routing issues when applicable. |
Tenable’s activity logs can be accessed through **Settings → Activity Logs**. [Activity Logs](https://docs.tenable.com/vulnerability-management/Content/Settings/activity-logs/ActivityLogs.htm?utm_source=chatgpt.com).
**Recommended Logging**
Where configurable, use:
| Level | Use |
| :-------- | :------------------------------------------------------------- |
| **INFO** | Routine execution summaries. |
| **WARN** | Rate limiting, retries, or recoverable issues. |
| **ERROR** | Failed operations requiring investigation. |
| **DEBUG** | Temporary troubleshooting with sensitive information redacted. |
**Sample Log Entries**
These examples illustrate useful diagnostic information; they are not actual AirMDR log formats.
```text theme={null}
INFO integration=tenable operation=list_scans http_status=200
WARN integration=tenable http_status=429 retry_after_seconds=30
ERROR integration=tenable operation=list_scans http_status=401
```
Do not log API keys, authentication headers, or unnecessary sensitive asset data.